Техническая информация
Вредоносные функции:
Выполняет код следующих детектируемых угроз:
- Android.Xiny.20
Сетевая активность:
Подключается к:
- UDP(DNS) <Google DNS>
- TCP(HTTP/1.1) c####.baidust####.com.####.com:80
- TCP(HTTP/1.1) www.yan####.net.cn:80
- TCP(HTTP/1.1) et2-na6####.wagbr####.ali####.####.com:80
- TCP(HTTP/1.1) s####.jom####.com:80
- TCP(HTTP/1.1) h####.b####.com:80
- TCP(HTTP/1.1) t####.w####.cn:80
- TCP(HTTP/1.1) image####.b####.com:80
- TCP(HTTP/1.1) si####.jom####.com:80
- TCP(HTTP/1.1) nsc####.b####.com:80
- TCP(HTTP/1.1) pag####.googles####.com:80
- TCP(HTTP/1.1) wn.pos.b####.com:80
- TCP(HTTP/1.1) img.web####.360.cn:80
- TCP(HTTP/1.1) e####.b####.com:80
- TCP(HTTP/1.1) app.w####.cn:80
- TCP(HTTP/1.1) b####.b####.com:80
- TCP(TLS/1.0) www.googlet####.com:443
- TCP(TLS/1.0) googl####.g.doublec####.net:443
- TCP(TLS/1.0) tpc.googles####.com:443
- TCP(TLS/1.0) www.go####.com:443
- TCP(TLS/1.0) www.gst####.com:443
- TCP(TLS/1.0) adser####.go####.nl:443
- TCP(TLS/1.0) pag####.googles####.com:443
Запросы DNS:
- ads.w####.cn
- adser####.go####.com
- adser####.go####.nl
- api.s####.b####.com
- app.w####.cn
- b####.b####.com
- b####.s####.b####.com
- c####.baidust####.com
- e####.b####.com
- e####.b####.com
- googl####.g.doublec####.net
- gy####.com
- h####.b####.com
- image####.b####.com
- img.web####.360.cn
- log.u####.com
- nsc####.b####.com
- pag####.googles####.com
- su####.leno####.com
- t####.w####.cn
- t10.b####.com
- t12.b####.com
- tpc.googles####.com
- wn.pos.b####.com
- www.go####.com
- www.googlet####.com
- www.gst####.com
- www.yan####.net.cn
Запросы HTTP GET:
- app.w####.cn/action/connect/active?app_id=####&udid=####&imsi=####&net=#...
- app.w####.cn/action/pop_ad/ad?app_id=####&udid=####&imsi=####&net=####&b...
- b####.b####.com/eye.php?actionid=####&attach=####×tamp=####&vn=####
- b####.b####.com/eye.php?t=####&actionid=####&attach=####&time=####&exp_l...
- b####.b####.com/eye.php?t=####&start=####&site_api_loaded=####&opt=####&...
- c####.baidust####.com.####.com/cpro/ui/i.js
- c####.baidust####.com.####.com/cpro/ui/noexpire/img/2.0.1/bg.png
- e####.b####.com/public03/imageplus/leftbottom.png
- e####.b####.com/public03/imageplus/sticker/leftbtn.jpg
- e####.b####.com/public03/imageplus/sticker/pa_lu_nobtn_inviewshow.app.js...
- e####.b####.com/public03/imageplus/sticker/rightbtn.jpg
- e####.b####.com/public03/imageplus/tip-back.png
- e####.b####.com/public03/imageplus/tip.png
- e####.b####.com/public03/imageplus/v2/dock/close.png
- et2-na6####.wagbr####.ali####.####.com/bar/get/5050000a52701576c50002f3/...
- image####.b####.com/ui?api=####&prot=####&tu=####&pic=####&vn=####&callb...
- image####.b####.com/ui?dri=####&formId=####&src=####&k=####&iurl[]=####&...
- img.web####.360.cn/status/pai/hash/e4a03d72a22c70fd4b1a5fc64de95652
- nsc####.b####.com/v.gif?pid=####&type=####&sign=####&desturl=####&linkid...
- pag####.googles####.com/pagead/js/adsbygoogle.js
- pag####.googles####.com/pagead/show_ads.js
- s####.jom####.com/static/api/css/share_style0_16.css?v=####
- s####.jom####.com/static/api/img/share/icons_0_16.png?v=####
- s####.jom####.com/static/api/js/base/tangram.js?v=####
- s####.jom####.com/static/api/js/component/partners.js?v=####
- s####.jom####.com/static/api/js/share.js?v=86835285.js?cdnversion=####
- s####.jom####.com/static/api/js/share/api_base.js
- s####.jom####.com/static/api/js/share/image_api.js
- s####.jom####.com/static/api/js/share/select_api.js
- s####.jom####.com/static/api/js/share/share_api.js?v=####
- s####.jom####.com/static/api/js/trans/logger.js?v=####
- s####.jom####.com/static/api/js/view/image_view.js
- s####.jom####.com/static/api/js/view/select_view.js?v=####
- s####.jom####.com/static/api/js/view/share_view.js?v=####
- s####.jom####.com/static/api/js/view/view_base.js
- s####.jom####.com/v.gif
- si####.jom####.com/it/u=2385217320,3395790153&fm=76
- si####.jom####.com/it/u=3525068913,1017391136&fm=76
- si####.jom####.com/it/u=3927854237,2252424523&fm=76
- si####.jom####.com/it/u=4271908175,1931901102&fm=76
- t####.w####.cn/action/androidTuan/list?app_id=####&udid=####&imsi=####&n...
- wn.pos.b####.com/adx.php?c=####
- www.yan####.net.cn/
- www.yan####.net.cn/favicon.ico
- www.yan####.net.cn/images/apple.png
- www.yan####.net.cn/images/hot.gif
- www.yan####.net.cn/images/ic_launcher.png
- www.yan####.net.cn/images/kwxmain.png
- www.yan####.net.cn/images/mj25864.png
- www.yan####.net.cn/images/mjbaoding64.png
- www.yan####.net.cn/images/mjdcg64.png
- www.yan####.net.cn/images/mjdjsc64.png
- www.yan####.net.cn/images/mjdjsr64.png
- www.yan####.net.cn/images/mjgdjph64.png
- www.yan####.net.cn/images/mjhebei64.png
- www.yan####.net.cn/images/mjjdmj64.png
- www.yan####.net.cn/images/mjkwx64.png
- www.yan####.net.cn/images/mjqdjt64.png
- www.yan####.net.cn/images/mjxlch64.png
- www.yan####.net.cn/images/new.gif
- www.yan####.net.cn/images/szbwz64.png
- www.yan####.net.cn/images/templatemo_body.jpg
- www.yan####.net.cn/images/templatemo_menu_hover.png
- www.yan####.net.cn/images/wbd64.png
- www.yan####.net.cn/images/xysbt64.png
- www.yan####.net.cn/mjkwx_version.xml
- www.yan####.net.cn/mystyle.css
Запросы HTTP POST:
- app.w####.cn/action/user_info
- h####.b####.com/app.gif
Изменения в файловой системе:
Создает следующие файлы:
- /data/data/####/.md5
- /data/data/####/.sec_version
- /data/data/####/AppSettings.xml
- /data/data/####/CacheTime.dat
- /data/data/####/Data.xml
- /data/data/####/Finalize_Flag.xml
- /data/data/####/Package_Name.xml
- /data/data/####/ShowAdFlag.xml
- /data/data/####/Start_Tag.xml
- /data/data/####/__Baidu_Stat_SDK_SendRem.xml
- /data/data/####/__local_last_session.json
- /data/data/####/__local_stat_cache.json
- /data/data/####/classes.dex
- /data/data/####/classes.jar
- /data/data/####/data_0
- /data/data/####/data_1
- /data/data/####/data_2
- /data/data/####/data_3
- /data/data/####/data_3 (deleted)
- /data/data/####/index
- /data/data/####/mjkwx.db
- /data/data/####/mjkwx.db-journal
- /data/data/####/webview.db-journal
- /data/data/####/webviewCookiesChromium.db-journal
- /data/data/####/ydsoft.mjkwx
- /data/media/####/.nomedia
- /data/media/####/AppPackage.dat
- /data/media/####/CacheTime.dat
- /data/media/####/UnPackage.dat
Другие:
Запускает следующие shell-скрипты:
- <Package> <Package> -1836364776 0 /data/app/<Package>-1.apk 43 <Package> 48 49
- chmod 755 <Package Folder>/.cache/<Package>
Загружает динамические библиотеки:
- secexe
Осуществляет доступ к приватному интерфейсу ITelephony.
Использует специальную библиотеку для скрытия исполняемого байт-кода.
Получает информацию о местоположении.
Получает информацию о сети.
Получает информацию о телефоне (номер, IMEI и т. д.).
Получает информацию об установленных приложениях.
Получает информацию о запущенных приложениях.
Отрисовывает собственные окна поверх других приложений.
